CVE-2026-92794

EUVD-2026-81057
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/OpenSignLabs/OpenSign
https://github.com/OpenSignLabs/OpenSign/blob/v2.41.0/apps/OpenSignServer/cloud/parsefunction/getDocument.js#L20-L32
https://github.com/OpenSignLabs/OpenSign/issues/2218
https://www.vulncheck.com/advisories/opensign-through-2.41.3-information-disclosure-via-getdocument